Geek Answers Handbook

HttpCookies requireSSL set to true on http does not cause any errors

I set the httpCookies requireSSL value to true in web.config and ran the web application on my local machine without starting https. Everything works fine when I try to read Request.Cookie.

He is not there. I assume that since I do not have SSL, it never created it, but there were no warnings about its failure. I only know when I try to read the cookie value.

Should this not warn you?

+4
source share
1 answer

Not. What the setting does is that it sends a 'Secure' parameter when setting the cookie. After receiving a cookie with this parameter, the client should only send it to the server when the connection used is secure.

This is why the client does not send the cookie back and you do not see it. In addition, the server should not send this type of cookie over an insecure connection.

See RFC-2109 , section 4.2.2 for an explanation of how the 'Secure' attribute is used and interpreted.

+7
source

More articles:


All Articles